Definitions

“General Data Protection Regulation (GDPR)” – European Union Regulation aimed at harmonizing
European legislation on the protection of personal data. It has been applied since May 25, 2018, and any reference
thereto should be interpreted to include national implementing legislation.

“Personal data” means any information relating to an identified or identifiable natural person
(“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online identifier or to
one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity
of that natural person.

“Processing” means any operation or set of operations which is performed on personal data or on sets
of personal data, whether or not by automated means, such as collection, recording, organization, structuring,
storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure or destruction.

“Sensitive personal data” means any personal data which contain information on racial or ethnic
origin, political opinions, religious or philosophical beliefs or trade union membership, physical and mental
health, genetic and biometric data, data on sexual life or sexual orientation, and information on criminal
convictions and offenses. Because of the nature of sensitive personal data, the legislation is much more rigorous
about how these data should be processed. The Company processes sensitive personal data only in accordance with the
law.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise
processed.

“Restriction of processing” means the marking of stored personal data with the aim of limiting their
processing in the future

“Collaborators” means natural persons with whom the Company might keep any kind of business or
contractual relationship or partnership.

“Controller” means the natural or legal person, public authority, agency or other body which, alone
or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and
means of such processing are determined by Union or Member State law, the controller or the specific criteria for
its nomination may be provided for by Union or Member State law.

Privacy Policy

1. Scope

This Privacy Statement describes our procedures regarding the processing of personal data, namely the collection,
registration, organizing, structuring, storing, adaptation or alteration, retrieval, search, use, disclosure by
transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction of your personal data.

“MAKARM SINGLE-MEMBER SA” reserves the right to modify and adjust this statement whenever deemed necessary, and the
changes will take effect in the moment you are notified of them, either via e-mail or by posting them on the
Internet or by any other way the Company deems appropriate.

In the event that the terms of your cooperation with “MAKARM SINGLE-MEMBER SA” are defined by more specific terms
regarding the protection of personal data, these terms shall apply in conjunction with the present ones. In the
event of incompatibility, the specific terms of use of each service shall prevail.

2. Collected data

• Personal/corporate name
• Email address.
• Postal address.
• Other contact information, such as our customers’ phone number or the phone number of our customers’ contact
  persons
• Invoicing details, namely the TIN and the Tax Office.

Personal data is also collected and processed in the case of telephone services.

3. Processing Purposes

The company “MAKARM SINGLE-MEMBER SA” collects and processes your personal data mentioned above for the following
purposes:

• “MAKARM SINGLE-MEMBER SA”, if it gets prior consent from you, might process your personal data in order to
  inform you of new services or promotions, either its own or from sponsors and collaborators, that might be of
  interest to you. For this purpose, it processes your data to present to you new services and promotions, its own
  or from sponsor and collaborators, that best serve your needs.
• “MAKARM SINGLE-MEMBER SA” may use personal data to improve its products and services.
• “MAKARM SINGLE-MEMBER SA” may use personal data to communicate for market research purposes.
• In any case, you are entitled to object to the processing of your personal data for the above purpose by
  addressing your request to……
• “MAKARM SINGLE-MEMBER SA” collects and processes the users of its website’s personal data solely for the
  purposes mentioned above and only to the extent strictly necessary to effectively serve those purposes.

4. Legal Basis

In order to be able to fulfill the contractual obligations of the company “MAKARM SINGLE-MEMBER SA” towards you and
to monitor the fulfillment of the contractual obligations of the company “MAKARM SINGLE-MEMBER SA”’s collaborators,
the legal basis according to which the Company legally processes the data of its members is Article 6, par. 1 (b) of
the GDPR, where it is stipulated that “MAKARM SINGLE-MEMBER SA” may process data if “processing is necessary for the
performance of a contract in which the data subject is a contracting party”.

Apart from “MAKARM SINGLE-MEMBER SA”’s contractual obligations, it also has to comply with several obligations
stemming from the current legislative framework. According to Article 6, par. 1 (c) of the GDPR, “MAKARM
SINGLE-MEMBER SA” might process personal data when processing is “necessary to comply with its legal obligation”.

According to the provisions of Article 6 par. 1 (f) of the GDPR, “MAKARM SINGLE-MEMBER SA” may process personal data
when such processing “is necessary for the purposes of the legitimate interests pursued by “MAKARM SINGLE-MEMBER
SA”, unless the interests or the fundamental rights and freedoms of data subjects that impose the personal data
protection prevail over such interests“.

The following cases are a non-exhaustive report of the legitimate interests pursued in order to successfully achieve
the corporate objectives:

• safeguarding your safety and protection.
• protecting the property of “MAKARM SINGLE-MEMBER SA”, as well as documenting, securing and enforcing claims from
  the Company against third parties for damages to its property.

In extremely limited cases, we might seek your consent through means of positive action (opt-in) before we proceed in
specific processing of your data. For example, we might ask for your consent to send you informative or promotional
material or to publish your data on corporate printed material or other means for promotional purposes.

5. Retention period

“MAKARM SINGLE-MEMBER SA” will retain the personal data as stipulated in the applicable provisions of the law and
only for as long as it is required to fulfill the purposes stated in the preceding sections or for the time required
by law or to defend “MAKARM SINGLE-MEMBER SA” against possible judicial actions to pursue claims. In addition, we
shall retain the personal data of the persons who subscribed to the newsletters until those persons inform us that
they no longer wish to receive newsletters from us.

6. Information Security

The actions followed by “MAKARM SINGLE-MEMBER SA” for processing personal data are carried out in a way that ensures
its confidentiality. In particular, they are carried out exclusively by the personnel of “MAKARM SINGLE-MEMBER SA”
instructed for that purpose. Moreover, all appropriate organizational and technical measures are taken to ensure
data security and protection against accidental or illegal destruction, accidental loss, alteration, prohibited
dissemination or access, and any other form of illegal processing.

7. Transmission to Third Parties

“MAKARM SINGLE-MEMBER SA” shall not in any way transmit the personal data of its members, nor interconnect its
archive in exchange for financial or other compensation with any third private companies, natural and legal persons,
public authorities or services or other organizations.

8. About Your Rights

One of the basic principles of the GDPR is the protection of the rights of natural persons regarding the processing
of their personal data. In this context, you have a set of rights related with your personal data that happen to be
processed by “MAKARM SINGLE-MEMBER SA”, namely:

• Right to object: this right allows you to object to the processing of your personal data,
  especially when the processing is done for purposes of a legitimate interest of the “MAKARM SINGLE-MEMBER SA”.
  If the processing is done for the purpose of serving its legitimate interests, “MAKARM SINGLE-MEMBER SA” will
  comply with your objection and terminate such processing unless “MAKARM SINGLE-MEMBER SA” can demonstrate
  absolute and legal reasons for processing, that prevail over your interests, rights and freedoms or such
  processing is done to establish, exercise or support legal claims of “MAKARM SINGLE-MEMBER SA”.
• Right to withdraw consent: If your personal data processing is based on prior consent, you have
  the right to withdraw your consent at any time and “MAKARM SINGLE-MEMBER SA” will cease the specific activity
  you previously consented to, unless there is an alternative legal basis justifying the continuation of your data
  processing for that purpose, in which case you will be informed.
• Rights to access and rectification and erasure: You can request at any time to be informed
  about your personal data that “MAKARM SINGLE-MEMBER SA” holds about you and request the editing, rectification,
  updating or erasure of that information. We might ask you additional information so as to process your request.
  However, since we give you access to the information we hold about you, this will be done without financial
  costs for you, unless your claim is “clearly unfounded or illegitimate”. Since we have the legal right to deny
  your request, in the event of such denial, we will inform you on the specific reasons for such denial.
• Right to restriction of processing: In some cases, you have the right to “block” or withdraw
  further use of your personal data. In practice this means that we can store your data, but we will not be able
  to process it further, unless such processing happens with your consent, or such processing is necessary either
  to establish, exercise or support legal claims of “MAKARM SINGLE-MEMBER SA”, or for the protection of the rights
  of another person or also for reasons of public interest. We keep lists of people who have requested to “block”
  the further use of their personal data to make sure that the restriction will be respected in the future.
• Right to portability: You have the right to transfer your personal data to other controllers.
  In practice this means that you have the ability to transfer the information we hold about you to any third
  party. In order to implement this right, we will provide you the data in a structured, commonly used and machine
  readable format so that you can transfer your data to another person responsible for processing. Alternatively,
  we can also send the data directly in your name. The right to portability applies to (a) data we process
  automatically (i.e. without human intervention), (b) for personal data provided by you (c) for personal data
  which is processed based on your consent, or whose processing is necessary for the execution of a contract.
• Right to lodge a complaint with competent authorities: You have the right to file a complaint
  to the competent supervisory authority, which for Greece is the Personal Data Protection Authority.

You can contact the Personal Data Protection Authority through the following ways:

Postal Address: Personal Data Protection Authority, Headquarters: 1-3 Kifissias Ave., P.C. 115 23,
Athens
Call Centre: +30-210 6475600
E-mail: contact@dpa.gr

9. Company’s Details

Name: MAKARM SINGLE-MEMBER SA
G.C.R. Number: 153956127000
T.I.N.: 996763305
Headquarters: Amnisos P.E.O. Tomprouk, 71500 Heraklion, Crete
Tel. +30 2810 380404
E-mail: info@uniqueblueresort.gr

Do you have any questions? Contact us

If you have any questions about this Statement, please contact us by e-mail to info@uniqueblueresort.gr